vgsp: eng59 - saved-window release carrier for the held MME CALL runs (default off)

When a 324 B draw window holds its CALL runs while the 2799-word pack is
incomplete, the pack can complete later (X lane or a 728 B window) but the
next client launch that would release the held calls is a per-frame lottery
(c756: MME-CALL-HOLD 18, pack complete, no next launch -> no REARM/mac=0x22).

Save the held window at MME-CALL-HOLD (raw pre-relocation stream + the
launch capture fields) into module memory. When the pack is complete and
resident and no client launch consumes the release within
sema_gl_mme_pack_release_ms, re-submit the saved capture through the normal
fill/build path with the held CALL runs KEPT (mme_hold_calls=false), no
prelude emission, and gr_synthetic/no guest release. The released
CALL(34) runs DRAW_IAB against the resident pack, the shape c716 proved.

New: sema_gl_mme_pack_release (bool, 0) / _ms (uint, 100); MME-CARRY-SAVE /
ARM/FIRE/COMPLETE/CANCEL/ABORT mode=release receipts. Beef-only, one fire per
pack completion, fail-closed on context/handle changes or launch errors. The
existing pack-continuation carrier is unchanged with its knob off.

Build rc 0; validation pending.

1 files changed, 27 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index dd7e64a..a27225b 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -515,6 +515,16 @@ struct gsp_phys_gr_submit {
 	 */
 	bool mme_carrier;
 	/*
+	 * SAVED-WINDOW RELEASE CARRIER (sema_gl_mme_pack_release): the caller
+	 * is the service's synthetic request carrying the snapshot the booter
+	 * took at a held-call window. The submit path replays the saved window
+	 * (raw bytes, so the normal relocation build runs again) with the held
+	 * CALL runs RELEASED, after the packed program completed. Distinct from
+	 * mme_carrier: this launch carries a real window and is not LOAD-ONLY.
+	 * No guest release/semaphore fields are set.
+	 */
+	bool mme_release;
+	/*
 	 * SESSION 153-CONTINUED-87: the first program VA the captured
 	 * window binds (SET_PIPELINE_PROGRAM_ADDRESS pair; 0 when none).
 	 * The launch builder uses its 4K page as the program family for
@@ -575,6 +585,23 @@ bool gsp_phys_gr_mme_carry_take(u32 h_object, u32 *gen, u32 *off,
 void gsp_phys_gr_mme_carry_cancel(const char *reason);
 void gsp_phys_gr_mme_carry_failed(int rc);
 
+/*
+ * Saved-window release carrier (sema_gl_mme_pack_release). The booter saves
+ * the raw window + launch capture at a held-call window; once the packed
+ * program completes and no client window consumed the release within the
+ * settle grace, the service pump peeks for a due release, takes it
+ * (re-validating residency/handle) and queues the synthetic release request.
+ * release_fill() copies the saved capture into the caller's submit request
+ * (stream points at the saved kernel window); the work item then submits it
+ * through the normal fill/build path with the CALL runs released.
+ */
+bool gsp_phys_gr_mme_release_peek(u32 *h_object);
+bool gsp_phys_gr_mme_release_take(u32 h_object, u32 *held, u32 *win);
+void gsp_phys_gr_mme_release_cancel(const char *reason);
+void gsp_phys_gr_mme_release_failed(int rc);
+void gsp_phys_gr_mme_release_complete(void);
+bool gsp_phys_gr_mme_release_fill(struct gsp_phys_gr_submit *out);
+
 /* GR forwarding counters (submitted/verified/cancelled), plain reads. */
 void gsp_phys_backend_gr_counters(u64 *submitted, u64 *ok, u64 *refused,
 				  u64 *timed_out, u64 *pool_exhausted);